Reviewers: Yang,
Description:
Fix HGraphBuilder::BuildAddStringLengths
length == String::kMaxLength is fine and should not bail out.
BUG=chromium:357052
LOG=n
[email protected]
Please review this at https://codereview.chromium.org/222113002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+6, -9 lines):
M src/hydrogen.cc
A + test/mjsunit/regress/regress-crbug-357052.js
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
24c2ab40b64445905df381b9213a3e8695b97b36..6587ce97199ca944f8daaa8938bcbf73b23f6414
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -1794,7 +1794,8 @@ HValue* HGraphBuilder::BuildAddStringLengths(HValue*
left_length,
HValue* right_length) {
// Compute the combined string length and check against max string
length.
HValue* length = AddUncasted<HAdd>(left_length, right_length);
- HValue* max_length = Add<HConstant>(String::kMaxLength);
+ // Check that length <= kMaxLength <=> length < MaxLength + 1.
+ HValue* max_length = Add<HConstant>(String::kMaxLength + 1);
Add<HBoundsCheck>(length, max_length);
return length;
}
Index: test/mjsunit/regress/regress-crbug-357052.js
diff --git a/test/mjsunit/regress/regress-handle-illegal-redeclaration.js
b/test/mjsunit/regress/regress-crbug-357052.js
similarity index 69%
copy from test/mjsunit/regress/regress-handle-illegal-redeclaration.js
copy to test/mjsunit/regress/regress-crbug-357052.js
index
fe04ddb27cb97e47f6c6dd893ed8812e336b0c35..9cde1b66c284ecc4f5ab50ae5e52787fc65d1a1e
100644
--- a/test/mjsunit/regress/regress-handle-illegal-redeclaration.js
+++ b/test/mjsunit/regress/regress-crbug-357052.js
@@ -2,14 +2,10 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-// Flags: --always-opt
-
-var x = 0;
-
function f() {
- const c;
- var c;
- return 0 + x;
+ var str = "";
+ for (var i = 0; i < 30; i++) {
+ str += "abcdefgh12345678" + str;
+ }
}
-
assertThrows(f);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
